Mailing-List: contact dev-help@ranger.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ranger.apache.org
Content-Type: multipart/alternative;
 boundary="===============6972334695538928799=="
MIME-Version: 1.0
Subject: Re: Review Request 64228: Traverse check in RangerHdfsAuthorizer works
 incorrectly
From: Abhay Kulkarni <akulkarni@hortonworks.com>
To: Velmurugan Periasamy <vperiasamy@hortonworks.com>,
 Madhan Neethiraj <madhan@apache.org>,
 Colm O hEigeartaigh <coheigea@apache.org>, Ramesh Mani <rmani@hortonworks.com>,
 Zsombor Gegesy <gzsombor@gmail.com>
Cc: Abhay Kulkarni <akulkarni@hortonworks.com>, ranger <dev@ranger.apache.org>
Date: Tue, 05 Dec 2017 23:45:11 -0000
Message-ID: <20171205234511.19665.72890@reviews-vm2.apache.org>
Auto-Submitted: auto-generated
Sender: Abhay Kulkarni <noreply@reviews.apache.org>
References: <20171202012502.34997.48999@reviews-vm2.apache.org>
In-Reply-To: <20171202012502.34997.48999@reviews-vm2.apache.org>
Reply-To: Abhay Kulkarni <akulkarni@hortonworks.com>
archived-at: Tue, 05 Dec 2017 23:45:17 -0000

--===============6972334695538928799==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/64228/
-----------------------------------------------------------

(Updated Dec. 5, 2017, 11:45 p.m.)


Review request for ranger, Colm O hEigeartaigh, Zsombor Gegesy, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.


Changes
-------

Addressed review comments


Bugs: RANGER-1707
    https://issues.apache.org/jira/browse/RANGER-1707


Repository: ranger


Description
-------

Traversal check in RangerHdfsAuthorizer works incorrectly, when it is asked for access to /a/b/c.txt, it only checks that if there are a policy which grants EXEC to /a/b, but if it there aren't any, then it doesn't check, if there is a policy which grants READ, WRITE or EXEC to /a/b/c.txt explicitly, which would mean, that the path is accessible to the user.
This hasn't noticed by the current unit tests, because HDFS before 2.8.0 doesn't called the traversal check before reading or writing a file, however it will cause problem with 2.8.0, where FSDirectory.resolvePath will perform a mandatory traversal check.

This patch is based on the patch submitted for review (https://reviews.apache.org/r/61062/) with following modifications.
1. If traversal check (check for EXECUTE on the parent/ancestor if resource is a file) does not fail with explicit DENY by Ranger Authorizer, then it is presumed to have succeeded without any further checks and no audit record created. If it fails with DENY, then the authorization fails and an audit record is created.
2. Test policies in hdfs-policies.json and test cases (RangerHdfsAuthorizerTest) are modified to test for explicit DENY case.


Diffs (updated)
-----

  hdfs-agent/pom.xml 87ba777 
  hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java af4d9b5 
  hdfs-agent/src/test/java/org/apache/ranger/services/hdfs/RangerAdminClientImpl.java 75d73aa 
  hdfs-agent/src/test/java/org/apache/ranger/services/hdfs/RangerHdfsAuthorizerTest.java PRE-CREATION 
  hdfs-agent/src/test/resources/hdfs_version_3.0/hdfs-policies-tag.json PRE-CREATION 
  hdfs-agent/src/test/resources/hdfs_version_3.0/hdfs-policies.json PRE-CREATION 


Diff: https://reviews.apache.org/r/64228/diff/3/

Changes: https://reviews.apache.org/r/64228/diff/2-3/


Testing
-------

Unit tested with HDFS versions 2.7.1 and 3.0.0.


Thanks,

Abhay Kulkarni


--===============6972334695538928799==--